# How to identify the users? 7 messages from 2013-01-31 to 2013-01-31. Participants: Scott Yan, Tomas Carnecky, Sitaram Chamarty, Andrew Ardill. Thread: https://gitlist.dev/t/32790 ## Scott Yan, 2013-01-31 05:52 Subject: How to identify the users? Message-ID: URL: https://gitlist.dev/e/CACkbei%2BJby13B7rsEb3iLQM2ZSFDgrkgvrYC5M7u4yatppvLxA%40mail.gmail.com ``` Hello everyone: The user info of git client (user name and email) is set by the users themselves, so , how to avoid userA pretend to be userB? Git server could authentication the user, but it do nothing about the user info of commit message. For example: There are 20 people of my team, and everyone can push to the public repository(git server), If I found some backdoor code in my project, and the commit record shows it was committed by userA, so I ask userA: why do you do this? but he told me: no, this is not my code, I have never committed such thing. ----and yes, everyone could change his user info to userA very easily . so... what should I do to avoid such situations? Thanks! ``` ## Scott Yan, 2013-01-31 06:07 Subject: Re: How to identify the users? Message-ID: URL: https://gitlist.dev/e/CACkbeiKR4aYxP6uWtPVCsOLmNfj6fqv48vHdQokuAogR2b_a_Q%40mail.gmail.com In-Reply-To: ``` Thanks, Andrew. you said: --have the server reject commits that have the 'committer' set to someone other then the authenticated user but I don't know how to do that? Our central repository is hosted by apache, and there are some username and passwords saved by apache to authentication valid user, but as I know, there are no relation between the apache username and the git client user ino (saved in .gitconfig), so can you describe some detail? Regards, Scott Yan On Thu, Jan 31, 2013 at 1:56 PM, Andrew Ardill wrote: > > > > On 31 January 2013 16:52, Scott Yan wrote: >> >> The user info of git client (user name and email) is set by the users >> themselves, so , how to avoid userA pretend to be userB? >> >> Git server could authentication the user, but it do nothing about the >> user info of commit message. > > > The simplest thing is to have the server reject commits that have the > 'committer' set to someone other then the authenticated user. > > Of course, there are potential workflows that this would cause problems for, > such as if you sync directly to another user's repository and then try and > push those to a central server. > > The most robust system would probably involve using signed tags to verify > what is being pushed, however I am not aware of any set-ups that have done > this yet. > > Regards, > > Andrew Ardill ``` ## Tomas Carnecky, 2013-01-31 06:08 Subject: Re: How to identify the users? Message-ID: <1359612481-ner-5936@calvin> URL: https://gitlist.dev/e/1359612481-ner-5936%40calvin In-Reply-To: ``` On Thu, 31 Jan 2013 13:52:32 +0800, Scott Yan wrote: > Hello everyone: > > The user info of git client (user name and email) is set by the users > themselves, so , how to avoid userA pretend to be userB? > > Git server could authentication the user, but it do nothing about the > user info of commit message. > > For example: > There are 20 people of my team, and everyone can push to the public > repository(git server), > If I found some backdoor code in my project, and the commit record > shows it was committed by userA, so I ask userA: why do you do this? > but he told me: no, this is not my code, I have never committed such > thing. ----and yes, everyone could change his user info to userA very > easily . > > so... what should I do to avoid such situations? gitolite keeps a log of which SSH user pushed which commits. The smart-http backend does the same if you have reflog enabled on the server (see the ENVIRONMENT section in man git-http-backend). So unless someone can steal userA's credentials (http password, ssh key) you'll be able to detect who it really was. ``` ## Sitaram Chamarty, 2013-01-31 06:10 Subject: Re: How to identify the users? Message-ID: <510A0ACF.5060501@gmail.com> URL: https://gitlist.dev/e/510A0ACF.5060501%40gmail.com In-Reply-To: <1359612481-ner-5936@calvin> ``` On 01/31/2013 11:38 AM, Tomas Carnecky wrote: > On Thu, 31 Jan 2013 13:52:32 +0800, Scott Yan wrote: >> Hello everyone: >> >> The user info of git client (user name and email) is set by the users >> themselves, so , how to avoid userA pretend to be userB? >> >> Git server could authentication the user, but it do nothing about the >> user info of commit message. >> >> For example: >> There are 20 people of my team, and everyone can push to the public >> repository(git server), >> If I found some backdoor code in my project, and the commit record >> shows it was committed by userA, so I ask userA: why do you do this? >> but he told me: no, this is not my code, I have never committed such >> thing. ----and yes, everyone could change his user info to userA very >> easily . >> >> so... what should I do to avoid such situations? > > gitolite keeps a log of which SSH user pushed which commits. The smart-http > backend does the same if you have reflog enabled on the server (see the > ENVIRONMENT section in man git-http-backend). So unless someone can steal > userA's credentials (http password, ssh key) you'll be able to detect who it > really was. See also my rant on this topic: https://github.com/sitaramc/gitolite/blob/master/src/VREF/EMAIL-CHECK#L37 ``` ## Andrew Ardill, 2013-01-31 06:16 Subject: Re: How to identify the users? Message-ID: URL: https://gitlist.dev/e/CAH5451kaXQj3Qz0P_Ydd%2BBnXwiENvqGP8tg4hHOgU8i5J_x5Lg%40mail.gmail.com In-Reply-To: ``` (resending previous response. Forgot to turn off HTML, and apprently gmail doesn't wrap lines automatically anymore?) On 31 January 2013 16:52, Scott Yan wrote: > > The user info of git client (user name and email) is set by the users > themselves, so , how to avoid userA pretend to be userB? > > Git server could authentication the user, but it do nothing about the > user info of commit message. The simplest thing is to have the server reject commits that have the 'committer' set to someone other then the authenticated user. Of course, there are potential workflows that this would cause problems for, such as if you sync directly to another user's repository and then try and push those to a central server. The most robust system would probably involve using signed tags to verify what is being pushed, however I am not aware of any set-ups that have done this yet. Regards, Andrew Ardill ``` ## Scott Yan, 2013-01-31 06:53 Subject: Re: How to identify the users? Message-ID: URL: https://gitlist.dev/e/CACkbei%2B_dJowH-odL%2BUCS3hQwOwFZ7B5_6sxw%3DZZg1V4%3DupSKg%40mail.gmail.com In-Reply-To: <510A0ACF.5060501@gmail.com> ``` Thanks to all. Tomas: I can't find reflog setting of git-http-backend doc(http://www.kernel.org/pub/software/scm/git/docs/git-http-backend.html), I tried this setting: git config core.logAllRefUpdates true and after some test push, the output is as below: >git log -g master commit d34e61baa28eabf46ba5e9f6a2feb24cc683ed39 Reflog: master@{0} (Scott Yan ) Reflog message: push Author: Scott Yan Date: Thu Jan 31 14:19:30 2013 +0800 this log shows when pushed, but still can't tell Who, because the author info may be fake. I don't know if I made some mistake. Sitaram: It seems I must host my central repo on Gitolite first... I don't know Gitolite much, but you are right, maybe I should use Gitolite as my git server. I'll find more documents about gitolite these days, can you give me some suggestion which tutorial should I read? Thanks! ps: my OS is windows. Regards, Scott Yan On Thu, Jan 31, 2013 at 2:10 PM, Sitaram Chamarty wrote: > On 01/31/2013 11:38 AM, Tomas Carnecky wrote: >> On Thu, 31 Jan 2013 13:52:32 +0800, Scott Yan wrote: >>> Hello everyone: >>> >>> The user info of git client (user name and email) is set by the users >>> themselves, so , how to avoid userA pretend to be userB? >>> >>> Git server could authentication the user, but it do nothing about the >>> user info of commit message. >>> >>> For example: >>> There are 20 people of my team, and everyone can push to the public >>> repository(git server), >>> If I found some backdoor code in my project, and the commit record >>> shows it was committed by userA, so I ask userA: why do you do this? >>> but he told me: no, this is not my code, I have never committed such >>> thing. ----and yes, everyone could change his user info to userA very >>> easily . >>> >>> so... what should I do to avoid such situations? >> >> gitolite keeps a log of which SSH user pushed which commits. The smart-http >> backend does the same if you have reflog enabled on the server (see the >> ENVIRONMENT section in man git-http-backend). So unless someone can steal >> userA's credentials (http password, ssh key) you'll be able to detect who it >> really was. > > See also my rant on this topic: > > https://github.com/sitaramc/gitolite/blob/master/src/VREF/EMAIL-CHECK#L37 ``` ## Sitaram Chamarty, 2013-01-31 10:12 Subject: Re: How to identify the users? Message-ID: <510A4378.9010302@gmail.com> URL: https://gitlist.dev/e/510A4378.9010302%40gmail.com In-Reply-To: ``` On 01/31/2013 12:23 PM, Scott Yan wrote: > Sitaram: > > It seems I must host my central repo on Gitolite first... There is no "must" but yes it is a decent solution and can, in principle, do the kind of checking you want if you set it up to do that. Please note that I don't use that mode and, as my rant would have indicated, I don't think it's a smart thing to do. > I don't know Gitolite much, but you are right, maybe I should use > Gitolite as my git server. > I'll find more documents about gitolite these days, > can you give me some suggestion which tutorial should I read? Thanks! > ps: my OS is windows. Try http://therightstuff.de/CommentView,guid,b969ea4d-8d2c-42af-9806-de3631f4df68.aspx I normally don't mention blog posts (favouring instead the official documentation) but Windows is an exception. Hence the link. Good luck. ```